Stream: git-wasmtime

Topic: wasmtime / issue #7229 Cranelift: Egraph optimizations pr...

view this post on Zulip Wasmtime GitHub notifications bot (Oct 12 2023 at 17:52):

afonso360 added the bug label to Issue #7229.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 12 2023 at 17:52):

afonso360 added the cranelift label to Issue #7229.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 12 2023 at 17:52):

afonso360 opened issue #7229:

:wave: Hey,

This showed up in fuzzgen while I was fuzzing a unrelated branch, but it reproduces on main.

.clif Test Case

test compile
set opt_level=speed_and_size
target x86_64

function %a() -> i8 {
block0:
    v21 = iconst.i64 0x6350_5050_5050_3750
    v22 = iconst.i64 0x5050_5055_5050_3838
    v23 = iconcat v22, v21  ; v22 = 0x5050_5055_5050_3838, v21 = 0x6350_5050_5050_3750
    v39 = iconst.i8 0
    v51 = bmask.i8 v23
    v56 = select v51, v51, v51
    v65 = popcnt v56
    v67 = icmp ugt v65, v39  ; v39 = 0
    return v67
}

Steps to Reproduce

Expected Results

The test to pass.

Actual Results

afonso@DESKTOP-1AHKMV2:~/git/wasmtime/cranelift$ cargo run -- test ./lmao.clif
    Finished dev [unoptimized + debuginfo] target(s) in 0.20s
     Running `/home/afonso/git/wasmtime/target/debug/clif-util test ./lmao.clif`
thread 'worker #0' panicked at 'internal error: entered unreachable code', cranelift/codegen/src/verifier/mod.rs:1731:22
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: internal error: entered unreachable code
FAIL ./lmao.clif: panicked in worker #0: internal error: entered unreachable code
1 tests
Error: 1 failure

Versions and Environment

Cranelift version or commit: main

Operating system: Linux

Architecture: X64

Extra Info

The function looks like this after egraph optimizations:

function %a() -> i8 fast {
block0:
    v22 = iconst.i64 0x5050_5055_5050_3838
    v21 = iconst.i64 0x6350_5050_5050_3750
    v23 = iconcat v22, v21  ; v22 = 0x5050_5055_5050_3838, v21 = 0x6350_5050_5050_3750
    v74 = iconst.i128 0
    v75 = icmp ne v23, v74  ; v74 = 0
    v76 -> v75
    v77 -> v76
    v78 -> v77
    return v75
}

One of the rules is incorrectly producing a iconst.i128. Eventually the code ends up crashing during bounds checking in the verifier, but the root cause is a wrong rule in egraphs.

As an aside, how cool is it that we are able to reason through a popcnt, select and bmask and arrive at icmp ne, 0!

view this post on Zulip Wasmtime GitHub notifications bot (Oct 12 2023 at 17:52):

afonso360 edited issue #7229:

:wave: Hey,

This showed up in fuzzgen while I was fuzzing a unrelated branch, but it reproduces on main.

.clif Test Case

test compile
set opt_level=speed_and_size
target x86_64

function %a() -> i8 {
block0:
    v21 = iconst.i64 0x6350_5050_5050_3750
    v22 = iconst.i64 0x5050_5055_5050_3838
    v23 = iconcat v22, v21  ; v22 = 0x5050_5055_5050_3838, v21 = 0x6350_5050_5050_3750
    v39 = iconst.i8 0
    v51 = bmask.i8 v23
    v56 = select v51, v51, v51
    v65 = popcnt v56
    v67 = icmp ugt v65, v39  ; v39 = 0
    return v67
}

Steps to Reproduce

Expected Results

The test to pass.

Actual Results

afonso@DESKTOP-1AHKMV2:~/git/wasmtime/cranelift$ cargo run -- test ./lmao.clif
    Finished dev [unoptimized + debuginfo] target(s) in 0.20s
     Running `/home/afonso/git/wasmtime/target/debug/clif-util test ./lmao.clif`
thread 'worker #0' panicked at 'internal error: entered unreachable code', cranelift/codegen/src/verifier/mod.rs:1731:22
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: internal error: entered unreachable code
FAIL ./lmao.clif: panicked in worker #0: internal error: entered unreachable code
1 tests
Error: 1 failure

Versions and Environment

Cranelift version or commit: main

Operating system: Linux

Architecture: X64

Extra Info

The function looks like this after egraph optimizations:

function %a() -> i8 fast {
block0:
    v22 = iconst.i64 0x5050_5055_5050_3838
    v21 = iconst.i64 0x6350_5050_5050_3750
    v23 = iconcat v22, v21  ; v22 = 0x5050_5055_5050_3838, v21 = 0x6350_5050_5050_3750
    v74 = iconst.i128 0
    v75 = icmp ne v23, v74  ; v74 = 0
    v76 -> v75
    v77 -> v76
    v78 -> v77
    return v75
}

One of the rules is incorrectly producing a iconst.i128. Eventually the code ends up crashing during bounds checking in the verifier, but the root cause is a wrong rule in egraphs.

I'm opening this issue because I might not have time to look into it in the next few days.

As an aside, how cool is it that we are able to reason through a popcnt, select and bmask and arrive at icmp ne, 0!

view this post on Zulip Wasmtime GitHub notifications bot (Oct 30 2023 at 21:22):

alexcrichton closed issue #7229:

:wave: Hey,

This showed up in fuzzgen while I was fuzzing a unrelated branch, but it reproduces on main.

.clif Test Case

test compile
set opt_level=speed_and_size
target x86_64

function %a() -> i8 {
block0:
    v21 = iconst.i64 0x6350_5050_5050_3750
    v22 = iconst.i64 0x5050_5055_5050_3838
    v23 = iconcat v22, v21  ; v22 = 0x5050_5055_5050_3838, v21 = 0x6350_5050_5050_3750
    v39 = iconst.i8 0
    v51 = bmask.i8 v23
    v56 = select v51, v51, v51
    v65 = popcnt v56
    v67 = icmp ugt v65, v39  ; v39 = 0
    return v67
}

Steps to Reproduce

Expected Results

The test to pass.

Actual Results

afonso@DESKTOP-1AHKMV2:~/git/wasmtime/cranelift$ cargo run -- test ./lmao.clif
    Finished dev [unoptimized + debuginfo] target(s) in 0.20s
     Running `/home/afonso/git/wasmtime/target/debug/clif-util test ./lmao.clif`
thread 'worker #0' panicked at 'internal error: entered unreachable code', cranelift/codegen/src/verifier/mod.rs:1731:22
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent > FAIL: panicked in worker #0: internal error: entered unreachable code
FAIL ./lmao.clif: panicked in worker #0: internal error: entered unreachable code
1 tests
Error: 1 failure

Versions and Environment

Cranelift version or commit: main

Operating system: Linux

Architecture: X64

Extra Info

The function looks like this after egraph optimizations:

function %a() -> i8 fast {
block0:
    v22 = iconst.i64 0x5050_5055_5050_3838
    v21 = iconst.i64 0x6350_5050_5050_3750
    v23 = iconcat v22, v21  ; v22 = 0x5050_5055_5050_3838, v21 = 0x6350_5050_5050_3750
    v74 = iconst.i128 0
    v75 = icmp ne v23, v74  ; v74 = 0
    v76 -> v75
    v77 -> v76
    v78 -> v77
    return v75
}

One of the rules is incorrectly producing a iconst.i128. Eventually the code ends up crashing during bounds checking in the verifier, but the root cause is a wrong rule in egraphs.

I'm opening this issue because I might not have time to look into it in the next few days.

As an aside, how cool is it that we are able to reason through a popcnt, select and bmask and arrive at icmp ne, 0!

Last updated: Oct 23 2024 at 20:03 UTC